stuxnet-style-attack-detectionlisted

## When to Use - Hunting for covert PLC logic modification where the network shows no alerts. - Investigating process behavior that matches setpoints no operator entered. - Correlating a `plc-logic-integrity-check` MISMATCH with other telemetry. - Building a detection baseline for safety-related controllers. ## Prerequisites - Zeek logs from a SPAN of the segment: `conn.log`, `modbus.log` or S7comm captures. - Suricata `eve.json` from the same span, if deployed. - Historian export for the sensors and setpoints on the target controllers. - Change window calendar. Every detection below keys on the approved change schedule. - Output from `passive-ot-network-discovery` for the master-slave pair list. - Credentials: read-only historian access, read-only HMI audit logs. - Authorization: none for analysis. Every live controller check is gated upstream. - Upstream skills: `plc-logic-integrity-check` for the hash baseline. This skill interprets its output. ### Safety This skill is passive. No step in this workflow sends packets to a live device. - Passive. Analyzes logs, captures, and historian exports. Safe to run during normal operations. ## Workflow This skill is a detection strategy, not a single rule. It maps each Stuxnet-style indicator to a detection source and an escalation path. Record findings per indicator in `logic-tamper-detection-strategy.md`. 1. Build the change window table. One row per controller: approved change windows, approved engineering stations, approv